OpenID Connect 1.0 Provider
Sign in with PESU, without sharing your password.
An open-source, unofficial OAuth 2.0 authorization server for student apps and club sites at PES University. Students sign in on this page; apps get a token, never the PESU Academy password.
How it protects students
Identity
Zero Password Exposure
Apps receive standard RS256 JWTs. They never see, touch, or handle your PESU Academy password, and an identity-only sign-in stores nothing about it.
Delegated
AES-256-GCM Vault
Only apps an admin approves for delegated access can ask to keep a session. Credentials are sealed with envelope encryption and a per-user data key.
Protocol
Strict PKCE Required
Every authorization uses Proof Key for Code Exchange (S256), so an intercepted authorization code is useless on its own.
Standard OIDC. Works with the library you already use.
Configure your client ID and redirect URI in the portal, then point your library at the discovery document.
GET /.well-known/openid-configurationIntegration examples →Register an app
Create a client in the portal and add your redirect URI. It starts in Testing, open to you and your testers.
Point your OIDC library here
NextAuth, Lucia, Passport and AppAuth read everything from the discovery document.
Request Production
When it works, an admin reviews it and opens sign-in to every PESU student.
Open source under MIT. Read the code on GitHub. Not affiliated with PES University or PESU Academy.
FAQPrivacy